Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Quick question for you: Do you consider any of the following passwords secure?

  • thereisnofatebutwhatwemake
  • eastofthesunwestofthemoon
  • !)@(#*$&%^Test123
  • *tecno9654postgres
  • !@#$%^&*()_+lisa
  • Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn1

If your answer to just one of the above is "Yes"! Think again real hard about using a good password manager!

Those passwords above were all guessed using "dictionary lookup" attacks within hours or days (not weeks or years)! Several hours to days!

(And please note: there are all considerably longer than your simple "8 or 9 character passwords"!)

Rule of thumb: if you try to come up with a password that is based on any (combination of) word(s) that can be found "on the Internet" (Twitter, Wikipedia, websites, news groups, the Bible, other book texts available in electronic form, ...), it is very likely that it will be guessed! Even 1f u d0!permutat1ons$and_try2bcl3v3r! ("rule-based substitution attacks").

For a detailed background why you should be very concerned:

http://arstechnica.com/security/201...ing-the-next-frontier-of-password-cracking/2/
"How the Bible and YouTube are fueling the next frontier of password cracking"

And in the background of several major (commercial) sites were hacked and millions of encrypted passwords where stolen, you really should have different passwords for each and every service!

(What people often forget: they might have a hugely "secure password" for e.g. their Apple ID, but they have a weak password for their email, so attackers can guess the email password, reset the Apple ID with a confirmation email sent to that email address, and *zonK*! There you go! Your Apple ID accessible now to them as well!)




Well, as I said: reconsider of what you think is "secure"...

I'm not saying not using this app is more secure
 
I should let you know that because of limitations, 1password for iOS doesn't have autofill. I don't use it, but I probably will get it eventually.

1Password for iOS does have autofill if you use their web browser. I use it in those cases where I do need autofill in iOS.
 
The problem with an app remembering all your passwords is that if one day you find yourself at someone's house or on a device that doesn't have the app installed, you're basically screwed and pretty much locked out of the internet. I still think there's no alternative to remembering them all. Most of your passwords can be the same, since most sites aren't that important. I mean who cares if the password for the pizza delivery site is the same as the one you use for some forum you only logged into once?
 
The problem with an app remembering all your passwords is that if one day you find yourself at someone's house or on a device that doesn't have the app installed, you're basically screwed and pretty much locked out of the internet. I still think there's no alternative to remembering them all. Most of your passwords can be the same, since most sites aren't that important. I mean who cares if the password for the pizza delivery site is the same as the one you use for some forum you only logged into once?

I always have my iPhone with me. In the case where I need a password that can't be autofilled on a device that does not have 1Password installed on, I lookup the required password in 1Password on my iPhone and hand type it in.
 
I always have my iPhone with me. In the case where I need a password that can't be autofilled on a device that does not have 1Password installed on, I lookup the required password in 1Password on my iPhone and hand type it in.

Yup, this method works for me too :)
 
Any other similar apps, is it among the best?

Definitely Dashlane, without a doubt!
Been using it since the very beginning (couple of years) and i never ever looked back. Works like a charm, super safe, sleek modern interface, excellent syncing through iOS app, etc...
Also, the listed new stuff in One-Password have been present on Dashlane for quite some time as far as i'm concerned.
 
I always have my iPhone with me. In the case where I need a password that can't be autofilled on a device that does not have 1Password installed on, I lookup the required password in 1Password on my iPhone and hand type it in.

I use 1password on my laptops and my iPhone. The danger is if you are traveling and loose you iPhone and computer (say taxi robbery) and need to access a bank account details for transfers etc. You then need to download and install 1Password on a borrowed or public computer and sync it with your dropbox. This mean you need to know your Dropbox password! My suggestion is to make it and your 1Password vault password the same.
 
Web based Lastpass

I looked at these apps a while back and due to the cost of 1password, I decided to start with the free version of lastpass. But now with apple keychain, I have moved all my apple products and personal logins to keychain. I still use lastpass at work where I am stuck in the windows world. I actually like keychain better for my use, but there are a ton of features in lastpass that I don't use that keychain doesn't have. I guess I like it simple.

From my previous research I thought that 1password looked to be the best of the tools at that time. However, money kept me from it and now with keychain, I am not sure why I would ever spend the money on this tool.
 
For what it's worth, I've never seen ANYONE have anything bad to say about 1Password other than "I can't afford it".

For me, that's reason enough to buy it. They're the only product out there (AFAIK) that is actively writing about their security processes (including flaws). I wouldn't trust _any_ of the other applications.

I'm shocked, to be honest, by all of the people on this "tech" site that think that
1 - reusing passwords is okay
2 - they can remember all of the secure passwords that they need

For 1: you will be burned. it may not be today, it may not be tomorrow, but you will be burned. someone will spoof your name on a forum, or you'll forget that "hey, that pizza place actually has my credit card on file... oops"

For 2: it's either one or the other. they're either secure, or you can remember them. choose one. not both.
 
I would give it a shot, but $50.00 is out of my range at the moment. Wish they would throw out a few free codes or have a $10.00 sale.

It will appear for purchase with a group of ten apps before you know it. I purchased it if I remember, with a couple others and it made the cost well within reach
 
The best part of 1Password for me isn't with the password generation and storage, but all the other features.

  • It's an awesome software license database, including the ability to attach license files sent from developers.
  • It doesn't require an internet connection to simply look up a password.
  • It allows you to tweak individual parts of a site login via the edit button.
 
I would give it a shot, but $50.00 is out of my range at the moment. Wish they would throw out a few free codes or have a $10.00 sale.

Several times per year they put the Mac/Windows and iOS apps on sale for 50% off. They're well worth it at those prices. I had actually bought the Mac/Windows bundle at full price a few days before they went on sale. I contacted the company, and they refunded the difference within 24 hours. They've also been very responsive to questions and suggestions. AgileBits is a firm that is very much worthy of support with your money.
 
Do they allow anyone to examine the code? If not they could have built a back door in for the NSA etc

Some passwords managers allow anyone to examine the code to see it does exactly what they say it does.
 
What's the difference between this and Apple's password keychain?
 
Last edited:
I should let you know that because of limitations, 1password for iOS doesn't have autofill. I don't use it, but I probably will get it eventually.

1Password for Mac has been pretty solid for me though.

You mean Mobile Safari doesn't have extension support to allow for 1Password's integration to auto-fill like on OS X.

1Password for iOS's 1Browser had auto-fill support for years dating back to 1Password 3 as far as I remember.
 
Several times per year they put the Mac/Windows and iOS apps on sale for 50% off. They're well worth it at those prices. I had actually bought the Mac/Windows bundle at full price a few days before they went on sale. I contacted the company, and they refunded the difference within 24 hours. They've also been very responsive to questions and suggestions. AgileBits is a firm that is very much worthy of support with your money.

I will keep an eye out for a sale or free code.
 
Does 1Password access TouchID in iOS 7 to unlock the app?

TouchID is not available for anybody to use, so don't expect 1Password to support this anytime soon. If Apple opens this up in the future iOS versions, I'd imagine 1Password can embed support for it if it is safe to do so.

I use 1password on my laptops and my iPhone. The danger is if you are traveling and loose you iPhone and computer (say taxi robbery) and need to access a bank account details for transfers etc. You then need to download and install 1Password on a borrowed or public computer and sync it with your dropbox. This mean you need to know your Dropbox password! My suggestion is to make it and your 1Password vault password the same.

That'd be the wrong suggestion as you'd be opening up your entire 1Password database if the thieves figure out your Dropbox.com password is the same as your 1Password master password. All they have to do is breach Dropbox to figure out your 1Password database.

You should recall two separate passwords or write down the Dropbox password in a secure place like a safe or bank deposit box. This is actually something you should always do anyway, in the event of an emergency.
 
Their Android version is a joke

Ahh -- good point. I don't use Android for anything anymore (and didn't have 1Password when I was using it), so I can't confirm directly, but I have seen the same sentiment repeated many places.
 
The problem with an app remembering all your passwords is that if one day you find yourself at someone's house or on a device that doesn't have the app installed, you're basically screwed and pretty much locked out of the internet. I still think there's no alternative to remembering them all. Most of your passwords can be the same, since most sites aren't that important. I mean who cares if the password for the pizza delivery site is the same as the one you use for some forum you only logged into once?

I use 1password on my laptops and my iPhone. The danger is if you are traveling and loose you iPhone and computer (say taxi robbery) and need to access a bank account details for transfers etc. You then need to download and install 1Password on a borrowed or public computer and sync it with your dropbox. This mean you need to know your Dropbox password! My suggestion is to make it and your 1Password vault password the same.

If you use Dropbox sync, you will have access to your entire keychain from anywhere as long as you have a trusted internet connection. The keychain file is actually a folder you can go into in Dropbox and then open the main HTML file to use 1PasswordAnywhere. It's a web-based, mirrored view of all your passwords with the same level of security as the main app. No downloading or installing of 1Password on the guest computer is necessary. This is a great feature for travel (I have a secure note with important info like passport and bank numbers) that Apple's Keychain or competitors don't have.

The only bit of caution is that I don't trust Dropbox to not give the government my password if asked, so I wouldn't use the same password for Dropbox and your 1Password master password. In the end, I have to remember 2 very strong passwords instead of 1, but that's not too difficult and the convenience of this feature is worth it.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.